dissection of a Cyber- Espionage attack

More documents

Recommendations

Info

Actionable IoCs What our methodology suggests #RSAC To operationalize the IoC you should develop, use and store it in a reusable logic.
Investigation: first step The Customer has initially escalated the problem to another team, but despite the efforts and a triage attempt, the result was not satisfactory. Few days after the triage they discover additional lateral movements in their network. At this point the Customer called us. We notice, since the initial talk, that the Customer was lacking any network visibility and the investigation was performed without a structured approach. No network visibility #RSAC No detailed analysis has been performed initially Limited quantity <strong>of</strong> historical logs The initial investigation has been limited to MD5 search on Domain machines.
Page 1 and 2: SESSION ID: CTT-W08 Evolving Threat
Page 3 and 4: Agenda What we discuss today Today
Page 5 and 6: The target: the moat without water
Page 7 and 8: The target: the moat without water
Page 9 and 10: The attack strategy How they break-
Page 11 and 12: Attack Overview: End of First Wave
Page 13 and 14: Attack Overview: End of Second Wave
Page 15 and 16: The attack strategy The infection p
Page 17 and 18: Pwning the core: CVE-2015-1701 AKA
Page 19 and 20: Patient Zero How the victim discove
Page 21 and 22: Patient Zero consequences How the a
Page 23 and 24: What we can bring to the table? #RS
Page 25: Actionable IoCs What our methodolog
Page 29 and 30: Our investigation Our approach tail
Page 31 and 32: APT 28 Tools APT 28 Tools seen in t
Page 33 and 34: APT 28 Tools CORESHELL ATTRIBUTION
Page 35 and 36: APT 28 Tools EVILTOSS ATTRIBUTION B
Page 37 and 38: APT 28 Tools CHOPSTICK CHOPSTICK i
Page 39 and 40: The attack strategy IOC: C2 list T
Page 41 and 42: Conclusion What I can suggest It i
Page 43 and 44: #RSAC

dissection of a Cyber- Espionage attack

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?